In plain words
Imagine you told a friend your address, but they wrote it down and kept it even after you asked them to forget it. That's kind of what happened with Google and the location data of its users. Google collected and kept location data in a way that was not transparent to its users.
What's broken
The Data Protection Commission in Ireland fined Google 403 million euros for violating the General Data Protection Regulation¹, which is a law that protects people's personal data. The violations involved location data, transparency, retention, and user control. This means Google did not clearly tell users how their location data was being used, did not properly handle the data, and did not give users enough control over their own data.
How it actually works
The General Data Protection Regulation¹ requires companies to be clear about what data they collect and how they use it. Google did not meet these requirements, which led to the fine. The investigation started in 2020 and was based on complaints from six years ago. This shows that companies must follow the rules to protect users' data.
Proof of concept
It is not clear from the source if there is a public proof of concept that demonstrates the impact of Google's actions on user data. However, the fine itself indicates that Google's practices were not in line with the General Data Protection Regulation¹.
Is it real
The fine indicates that Google's misuse of location data was real and had significant consequences. The fact that the investigation took years shows that the issue was complex and required thorough examination. There are no indications that this issue is being actively exploited in the wild, as it pertains to Google's internal practices rather than a vulnerability in their systems.
What to do
To avoid similar issues, companies should ensure they are transparent about data collection and usage, and provide users with clear controls over their data. Users can also take steps to protect their location data by reviewing the permissions they grant to apps and services.
Terms
- ¹ General Data Protection Regulation
- , A law that protects people's personal data by requiring companies to be clear about what data they collect and how they use it.